Hardware wallet maker Foundation, creator of the Passport Bitcoin wallet, has reported a customer data exposure incident after attackers compromised Cloudflare API keys to distribute phishing emails directly from official company domains.
Legacy WooCommerce Data Triggers Phishing Campaign
The security breach was first disclosed on X, where Foundation notified users that unauthorized spam emails had originated from its domain infrastructure. Following an investigation, the company identified and revoked at least one compromised Cloudflare API key and brought down the external malicious domain linked in the phishing attempts.
Across its communication platforms, Foundation detected over 23,000 phishing email attempts. Attackers routed roughly 19,000 messages through Mailgun and more than 1,500 via Google Workspace. The leaked contact information stemmed from legacy WooCommerce database tables that failed to redact customer details 60 days after product shipping as intended. Unredacted data remained accessible in older database tables, refund logs, contact forms, and abandoned cart records. Notably, 5,000 email addresses targeted in the attack were absent from both legacy WooCommerce logs and current store records on Shopify.
Hardware Devices Unaffected Amid Broader Industry Breaches
Foundation confirmed that there is no evidence indicating Passport hardware devices or customer private keys were compromised. As a precaution, the team is rotating all internal system keys and storing an offline copy of the legacy WooCommerce database exclusively for forensic investigators before proceeding with permanent deletion.
- 23,000+ phishing email attempts recorded across Mailgun and Google Workspace.
- Cloudflare API keys revoked and malicious spam domains neutralized.
- Legacy WooCommerce database retained unredacted shipping and contact details.
- Zero compromise detected on Passport hardware devices or stored private keys.
The incident follows several security compromises across the hardware wallet sector. In August, logistics partner ShipMonk suffered a data breach exposing information for 67,000 Trezor users. In October, security researchers reported $80 million in potential losses from Ledger wallets acquired through Southeast Asian distributor CryptoBilis, where physical tampering was detected. Furthermore, on October 20, Keystone Wallet confirmed unauthorized access to its website database, exposing customer shipping details. As hardware security concerns mount, many crypto wallets are expanding in-app features to adapt to changing user priorities.
Why It Matters
Although hardware isolation prevents attackers from extracting private keys directly from Passport devices, metadata leaks expose hardware wallet owners to severe targeted phishing campaigns. Detailed customer order histories allow malicious actors to craft highly persuasive social engineering schemes or attempt physical supply-chain attacks. As legacy e-commerce databases continue to pose systemic vulnerabilities for hardware manufacturers, self-custody users must verify all digital communications independently of domain authenticity.
